4 ms·
Can you elaborate on injecting session cookies? If the secret was in the error page why did you need to do anything besides crash the app?
by foobarqux 14y ago
Can you elaborate on injecting session cookies? If the secret was in the error page why did you need to do anything besides crash the app?
- lmz 14y agoThe secret is used to create a valid cookie with the required values in the session e.g. User = karma_fountain. After setting the cookie, I can use the browser to transfer karma to my account, since the browser will be logged on as karma_fountain.
- tlrobinson 14y agoThe "secret" exposed in the exception page wasn't the actual flag, it was the secret used to sign session cookies. Once you had it you could modify your session cookie (typically to pose as a different user) and re-sign the cookie with the secret.